remcos | 07a065c4b19b8f98199e9ad84c2b2073e84bf0abdc3c075b9976abdeb5e40e73

Analysis

max time kernel
148s
max time network
150s
platform
windows10_x64
resource
win10v20210408
submitted
05-05-2021 15:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

RFQ-00421-0505.exe
Size

759KB
MD5

5810ce2501a4eb374d6645f732c7a09c
SHA1

b10725b4231b66db00b7d070b1598d97b6fedd39
SHA256

07a065c4b19b8f98199e9ad84c2b2073e84bf0abdc3c075b9976abdeb5e40e73
SHA512

7c31c0e4ae9f5d983a83670700f54132cb9709056a46449a52a349ea2ce0e194b385f7682a9643eeb2b02b834006c7a970f6239f4592d33892f655dad1abad53

Score

10^/10

remcos persistence rat

Malware Config

Extracted

Family

remcos

style.ptbagasps.co.id:42024

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

RFQ-00421-0505.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Windows\CurrentVersion\Run\Zdzipp = "C:\\Users\\Public\\ppizdZ.url"	RFQ-00421-0505.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

RFQ-00421-0505.exe

description pid process target process

PID 4656 set thread context of 3908 4656 RFQ-00421-0505.exe dialer.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

dialer.exe

pid process

3908 dialer.exe

description	pid	process	target process
PID 4656 set thread context of 3908	4656	RFQ-00421-0505.exe	dialer.exe

pid	process
3908	dialer.exe

Suspicious use of WriteProcessMemory 5 IoCs

Processes:

RFQ-00421-0505.exe

description	pid	process	target process
PID 4656 wrote to memory of 3908	4656	RFQ-00421-0505.exe	dialer.exe
PID 4656 wrote to memory of 3908	4656	RFQ-00421-0505.exe	dialer.exe
PID 4656 wrote to memory of 3908	4656	RFQ-00421-0505.exe	dialer.exe
PID 4656 wrote to memory of 3908	4656	RFQ-00421-0505.exe	dialer.exe
PID 4656 wrote to memory of 3908	4656	RFQ-00421-0505.exe	dialer.exe

C:\Users\Admin\AppData\Local\Temp\RFQ-00421-0505.exe
"C:\Users\Admin\AppData\Local\Temp\RFQ-00421-0505.exe"
1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4656

C:\Windows\SysWOW64\dialer.exe
C:\Windows\System32\dialer.exe
2⤵
- Suspicious use of SetWindowsHookEx
PID:3908

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3908-119-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download
memory/3908-120-0x000000000042EEEF-mapping.dmp

Download
memory/3908-123-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download
memory/4656-114-0x00000000005F0000-0x000000000073A000-memory.dmp

Filesize
1.3MB

Download
memory/4656-116-0x00000000024B0000-0x00000000024CA000-memory.dmp

Filesize
104KB

Download